Does not respect "administrator only registration" when "unified login" activated

I can confirm this. We've had several spam users on our page even when mollom was additionally active.

We've searched for a long time, what might be the reason. The Register form should never show up, if user registration is disallowed in user settings!
I think this is quite major!

Why would you set unified login/registration if you only permit administrator registration? Surely if you just switch off unified registration this problem goes away?

Well, of course you are right, BUT
- If the page is massive you might forget one of the options
- It is easier to fix then to document this flaw for every user
- It is just misbehaviour to show a registration page, if it is disabled in core.

So of course disabling both is a perfect fix but should not be required.

Well, your suggestion is right, I think.

In my eyes it is a bug, because it "breaks" core functionality so to say, because it allows other users to register, even if it is not allowed. One thing is UI-centric, the other thing is rule-centric you may say.

I'd describe the more important story the other way around: You are running a Drupal site for a longer period of time and then you have to close registration for some reason (Security, ...). So you set "admin registration only"... everything should be fine... BUT LoginToboggan overrides this without any hint. User can register further... we've exactly had this problem.
I dont't think this is good. Perhaps it might even be critical in some circumstances. Would you agree?

Here's a use case to consider:
I only allow Admin-created accounts and I was hoping to eliminate Drupal's worthless "Log in" and "Request New Password" tabs with LoginToboggan's slick unified login option. However I cannot do this because the unified login overrides my account creation settings :(

This should likely be checked in the latest -dev release and if it can be reproduced this issue should be marked for -dev as no fixes will be added to 7.x-1.3

The situation that I need this to work in, is when I am using Domain access. Basically some domains do not all registration, and others do.

here is a patch to fix this.

It worked for me after changing after parameters
LoginToboggan
Log in
Allow users to login using their e-mail address Disabled

Use two e-mail fields on registration form Disabled

Set password cleared

Non-authenticated role

Delete unvalidated users after

Immediate login

This works but it's useless to display only one tab in that case:"I have an account". All the login-links div should be in the if statement, like this:

  // Create the initial message and links that people can click on.
  $output .= '<div id="login-message">' . t('You are not logged in.') . '</div>';
  if (variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL)) {
    $output .= '<div id="login-links">';
    $output .= l(t('I have an account'), 'user/login', array('attributes' => array('class' => array('login-link'), 'id' => 'login-link')));
    $output .= ' ';
    $output .= l(t('I want to create an account'), 'user/register', array('attributes' => array('class' => array('login-link'), 'id' => 'register-link')));
    $output .= '</div>';
  }

I have the same problem even without using the unified form. The only Toboggan functionality I have turned on is to allow users to log in using both email or username. My site uses admin approved registrations, yet when Toboggan is enabled, all the registrations go automatically to active, which is effectively bypassing the admin approval.

Duplicate/related: #1017106: Enabling the Unified registration page breaks the 'administrators only' account creation setting

Another point related to this is that the message displayed when the Present login form on access denied (403) option is enabled reads

Access denied. You may need to login below or register to access this page.

even when registration is disabled. The "or register" bit shouldn't be shown when registering is not an option (i.e. the 'register' link does not appear on the login form).

(Or should I raise this as a separate issue? Sorry if I'm cluttering things here.)

Core function user_register_access() instead of variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) can be used in if statement.

Just ran into this myself, glad to see it's a known issue.